say when a stored token cannot be decrypted

The frame answered {"error":"internal error"} on every request. The cause was
AES-GCM failing with "Unsupported state or unable to authenticate data" — the
token in service_connections was encrypted under a key that no longer exists,
because the platform mints its encryption key on first use and does not back it
up. The same loss took slskd, memos and gitea credentials on this project's own
server earlier today.

It presented as a broken sidecar. connectionState reported `configured: true`
because a ROW exists, so the panel skipped the form and went to the frame,
where every call threw. Nothing offered a way to fix it, and the connection
form was unreachable precisely because it only appears when unconfigured.

Now a named failure. `UnreadableCredentials` is distinguished from every other
error — a database that is down keeps its own message, or a real fault would be
reported as "re-enter your token" — and the panel shows the form saying the key
changed, nothing else is lost, and the URL is still there.

Verified by the platform itself refusing to decrypt: this is the state that
machine has been in all day.

sidecar/upstream.ts

@@ -46,9 +46,37 @@ export function invalidateAllGiteaConfigs(): void {
 //
 // A member's URL is never read from their own row because it is never written there. That is what stops
 // a settings form from becoming a per-user SSRF hop.
+/**
+ * Thrown when the stored token exists but cannot be decrypted.
+ *
+ * Not a hypothetical. The platform's encryption key is minted on first use and NOT backed up, so losing
+ * the key file re-mints it and every previously encrypted column becomes unreadable — which happened on
+ * this project's own server, taking slskd, memos and gitea credentials with it. AES-GCM reports it as
+ * "Unsupported state or unable to authenticate data", a message that says nothing to whoever sees it.
+ *
+ * Distinguished from "not configured" because the remedy differs: nothing is broken, a token simply has
+ * to be pasted again.
+ */
+export class UnreadableCredentials extends Error {
+  constructor() {
+    super('stored gitea credentials cannot be decrypted — the token needs entering again');
+    this.name = 'UnreadableCredentials';
+  }
+}
+
 export async function getGiteaConfig(userId: number): Promise<GiteaConfig | null> {
   if (cache.has(userId)) return cache.get(userId) ?? null;
-  const row = await getResolvedServiceCredentials(userId, 'gitea');
+  let row: Awaited<ReturnType<typeof getResolvedServiceCredentials>>;
+  try {
+    row = await getResolvedServiceCredentials(userId, 'gitea');
+  } catch (err) {
+    // Only the decrypt failure is translated. Anything else — a database that is down, a bug — must keep
+    // its own error, or a real fault would be reported to the owner as "re-enter your token".
+    if (err instanceof Error && /unable to authenticate data|unsupported state/i.test(err.message)) {
+      throw new UnreadableCredentials();
+    }
+    throw err;
+  }
   const config = row ? { id: row.id, base: normalizeBase(row.url), token: row.secret } : null;
   cache.set(userId, config);
   return config;